# django.core.exceptions.SuspiciousOperation: Invalid HTTP_HOST header: 'evil.com'.

- **ID:** `python/django-query-parameter-injection`
- **Domain:** python
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

请求中的 Host 头不匹配 ALLOWED_HOSTS 设置

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 3.2 | active | — | — |
| 4.0 | active | — | — |
| 5.0 | active | — | — |

## Workarounds

1. **在 ALLOWED_HOSTS 中列出有效域名** (100% success)
   ```
   ALLOWED_HOSTS = ['example.com', 'www.example.com']
   ```
2. **使用环境变量配置** (95% success)
   ```
   ALLOWED_HOSTS = os.environ.get('ALLOWED_HOSTS', '').split(',')
   ```

## Dead Ends

- **在 ALLOWED_HOSTS 中添加通配符 '*'** — 降低安全性，允许任意 Host 头，可能导致 HTTP Host 头攻击 (80% fail)
- **忽略错误继续处理** — Django 会抛出 SuspiciousOperation 异常，无法忽略 (100% fail)